report the granter login's real error and retry on a standby store

nix/script-tests/granter-login.nix

@@ -0,0 +1,43 @@
+# `checks.script-test-granter-login` — runs ../host-modules/lib/granter-login.nix
+# against a stub `bao` whose login and status answers are set per case. The
+# cases are in ./granter-login.sh and the stub is ./granter-login-fake-bao.sh.
+#
+# What runs is the rendered login, with the same `baoStoreUp` text the unit
+# passes, rendered once with the bootstrap-token hint and once without.
+{
+  pkgs,
+  ...
+}:
+let
+  render =
+    haveBootstrapToken:
+    pkgs.writeText "granter-login.sh" (
+      import ../host-modules/lib/granter-login.nix {
+        inherit (pkgs) lib;
+        granterCn = "bao-granter";
+        granterPolicyName = "bao-granter";
+        inherit haveBootstrapToken;
+        baoStoreUp = ''HOME=/var/empty bao status >/dev/null 2>>"$err"'';
+        setupSteps = [ "bao policy write bao-bootstrap /etc/bootstrap.hcl" ];
+      }
+    );
+
+  fakeBao = pkgs.runCommand "fake-bao" { } ''
+    install -Dm755 ${./granter-login-fake-bao.sh} $out/bin/bao
+    patchShebangs $out/bin
+  '';
+in
+pkgs.runCommand "hyperhive-script-test-granter-login"
+  {
+    LOGIN = render false;
+    LOGIN_WITH_TOKEN = render true;
+    FAKE_BAO_BIN = "${fakeBao}/bin";
+    nativeBuildInputs = [
+      pkgs.coreutils
+      pkgs.gnugrep
+    ];
+  }
+  ''
+    ${pkgs.bash}/bin/bash ${./granter-login.sh}
+    touch "$out"
+  ''